0

I am trying to build a sample pipeline of adding two numbers. While running kfp.Client().create_run_from_pipeline_func(calc_pipeline, arguments=arguments) below error I a getting for faceless account.

**ApiException: (403)
Reason: Forbidden
HTTP response headers: HTTPHeaderDict({'content-type': 'application/json', 'trailer': 'Grpc-Trailer-Content-Type', 'date': 'Wed, 03 Aug 2022 09:39:23 GMT', 'x-envoy-upstream-service-time': '14', 'server': 'envoy', 'transfer-encoding': 'chunked'})
HTTP response body: {"error":"Failed to authorize with API resource references: Failed to authorize with API resource references: PermissionDenied: User 'sysspendanalytics' is not authorized with reason:  (request: \u0026ResourceAttributes{Namespace:sysspendanalytics,Verb:list,Group:pipelines.kubeflow.org,Version:v1beta1,Resource:experiments,Subresource:,Name:,}): Unauthorized access","code":7,"message":"Failed to authorize with API resource references: Failed to authorize with API resource references: PermissionDenied: User 'sysspendanalytics' is not authorized with reason:  (request: \u0026ResourceAttributes{Namespace:sysspendanalytics,Verb:list,Group:pipelines.kubeflow.org,Version:v1beta1,Resource:experiments,Subresource:,Name:,}): Unauthorized access","details":[{"@type":"type.googleapis.com/api.Error","error_message":"User 'sysspendanalytics' is not authorized with reason:  (request: \u0026ResourceAttributes{Namespace:sysspendanalytics,Verb:list,Group:pipelines.kubeflow.org,Version:v1beta1,Resource:experiments,Subresource:,Name:,})","error_details":"Failed to authorize with API resource references: Failed to authorize with API resource references: PermissionDenied: User 'sysspendanalytics' is not authorized with reason:  (request: \u0026ResourceAttributes{Namespace:sysspendanalytics,Verb:list,Group:pipelines.kubeflow.org,Version:v1beta1,Resource:experiments,Subresource:,Name:,}): Unauthorized access"}]}**
Adiii
  • 54,482
  • 7
  • 145
  • 148
Vinay Kumar
  • 1
  • 1

1 Answers1

0

Kubeflow implements RBAC based policy for governing access to Kubeflow resources. Policies are configured automatically, so that users can only access things associated with their workspace, and may not access resources associated with another user’s workspace.

I propose to check:

  • if there is a k8s role created by Kubeflow in the namespace sysspendanalytics
  • if it contains the verb list to the resource experiments
  • if there is a RoleBinding that grants the found role to the user sysspendanalytics
Hussein Awala
  • 4,285
  • 2
  • 9
  • 23